Tag Archives: vpn

Setup PPTP Server on Ubuntu 16.04

apt-get install pptpd
nano /etc/pptpd.conf
localip 10.0.0.1
remoteip 10.0.0.100-200

Setup authentication
adding users and passwords. Simply add them to /etc/ppp/chap-secrets

nano /etc/ppp/chap-secrets

Add DNS Servers

nano /etc/ppp/pptpd-options
ms-dns 8.8.8.8
ms-dns 8.8.4.4
service pptpd restart

Setup Forwarding

nano /etc/sysctl.conf
net.ipv4.ip_forward = 1
sysctl -p

Create a NAT rule for iptables

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Preserving Iptables Rules
https://pupli.net/2017/12/22/set-up-openconnect-vpn-server-ocserv-on-ubuntu-16-04-17-10-with-lets-encrypt

References
https://www.digitalocean.com/community/tutorials/how-to-setup-your-own-vpn-with-pptp

Install and Configure Shadowsocks with obfusaction

# Debian / Ubuntu
sudo apt-get install --no-install-recommends build-essential autoconf libtool libssl-dev libpcre3-dev libev-dev asciidoc xmlto automake

git clone https://github.com/shadowsocks/simple-obfs.git
cd simple-obfs
git submodule update --init --recursive
./autogen.sh
./configure && make
sudo make install

On the server:

ss-server -c config.json --plugin obfs-server --plugin-opts "obfs=http"

References
https://github.com/shadowsocks/simple-obfs
https://github.com/shadowsocks/shadowsocks-libev

Hide OpenVPN traffic using Obfsproxy on Ubuntu16.04

sudo pip install obfsproxy
obfsproxy --log-min-severity=info obfs2 --dest=127.0.0.1:1194 --shared-secret=<some-random-key> server 0.0.0.0:8080

References
https://www.comparitech.com/blog/vpn-privacy/hide-openvpn-traffic-obfsproxy-on-windows-and-linux-ec2/
https://community.openvpn.net/openvpn/wiki/TrafficObfuscation
https://sourceforge.net/p/openvpn/mailman/message/28851866/
https://dlshad.net/bypassing-censorship-by-using-obfsproxy-and-openvpn-ssh-tunnel/

OpenVPN software repository for Ubuntu 16.04

sudo -s
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg|apt-key add -
echo "deb http://build.openvpn.net/debian/openvpn/<version> <osrelease> main" > /etc/apt/sources.list.d/openvpn-aptrepo.list
echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" > /etc/apt/sources.list.d/openvpn-aptrepo.list
apt-get update && apt-get install openvpn

References
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

Set up OpenConnect VPN Server (ocserv) on Ubuntu 16.04/17.10 with Let’s Encrypt

Installing OpenConnect VPN Server on Ubuntu 16.04/17.10

sudo apt install ocserv

Installing Let’s Encrypt Client (Certbot) on Ubuntu 16.04/17.10 Server

sudo apt install ocserv
sudo apt install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt update
sudo apt install certbot

Obtaining a TLS Certificate from Let’s Encrypt

certbot certonly --standalone -d ocserv.example.com

Editing OpenConnect VPN Server Configuration File

sudo nano /etc/ocserv/ocserv.conf
auth = "plain[/etc/ocserv/ocpasswd]"
tcp-port = 443
udp-port = 443
run-as-user = nobody
run-as-group = daemon
socket-file = /var/run/ocserv-socket
server-cert = /etc/letsencrypt/live/ocserv.ml/fullchain.pem
server-key = /etc/letsencrypt/live/ocserv.ml/privkey.pem
ca-cert = /etc/letsencrypt/live/ocserv.ml/chain.pem
max-clients = 8
max-same-clients = 0
try-mtu-discovery = true
device = vpns
dns = 8.8.8.8
dns = 8.8.4.4
cisco-client-compat = true
default-domain = ocserv.example.com
tunnel-all-dns = true

Then comment out all the route directives (add # symbol at the beginning of the following four lines), which will set the server as the default gateway for the clients.

route = 10.10.10.0/255.255.255.0
route = 192.168.0.0/255.255.0.0
route = fef4:db8:1000:1001::/64

no-route = 192.168.5.0/255.255.255.0

Fixing DTLS Handshake Failure

DTLS handshake failed: Resource temporarily unavailable, try again.
sudo cp /lib/systemd/system/ocserv.service /etc/systemd/system/ocserv.service
sudo nano /etc/systemd/system/ocserv.service

Comment out the following two lines.

Requires=ocserv.socket

Also=ocserv.socket
sudo systemctl daemon-reload
sudo systemctl stop ocserv.socket
sudo systemctl disable ocserv.socket
sudo systemctl restart ocserv.service

Creating VPN Accounts

sudo ocpasswd -c /etc/ocserv/ocpasswd username

Enable IP Forwarding

sudo nano /etc/sysctl.conf
net.ipv4.ip_forward = 1
sudo sysctl -p

Configure Firewall for IP Masquerading

ifconfig
sudo iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE

Preserving Iptables Rules

apt-get install iptables-persistent

If apt-get install iptables-persistent has no effect, run dpkg-reconfigure iptables-persistent instead

Or do it manually :
By default, iptables ruls are lost after reboot. To preserve them, you can switch to root user and then save your rules to a file.

su -

iptables-save > /etc/iptables.rules
nano /etc/systemd/system/iptables-restore.service
[Unit]
Description=Packet Filtering Framework
Before=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore /etc/iptables.rules
ExecReload=/sbin/iptables-restore /etc/iptables.rules
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload

sudo systemctl enable iptables-restore

Install and Use OpenConnect VPN client on Ubuntu 16.04/17.10 Desktop

sudo apt install openconnect
sudo openconnect -b vpn.example.com:port-number

-b flag will make it run in the background after connection is established

sudo pkill openconnect
sudo apt install network-manager-openconnect network-manager-openconnect-gnome

References
https://www.linuxbabe.com/ubuntu/openconnect-vpn-server-ocserv-ubuntu-16-04-17-10-lets-encrypt
https://yoursunny.com/t/2017/ocserv-letsencrypt/
https://lowendbox.com/blog/install-openconnect-server-on-ubuntu-16-04/
https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-rules